Wireless (General)

  • 1.  Radius vs TACACS - CLI Authorization

    Posted 10-09-2015 22:07
    I'm looking to setup authorization based on CLI command with either TACACS or RADIUS.
    Apparently RADIUS seems to be a no-go according to this post: https://community.extremenetworks.com/extreme/topics/configuring-command-authorization-using-windows...

    TACACS on the other hand has the option in XOS
    #enable tacacs-authorization[/code]Can someone confirm this is currently only possible with TACACS and explain why such support is missing from RADIUS with XOS 15.1 onwards?
    Afterall, TACACS is Cisco while RADIUS should be open and the preferred way.


  • 2.  RE: Radius vs TACACS - CLI Authorization

    Posted 10-10-2015 07:11
    https://en.wikipedia.org/wiki/TACACS

    https://community.extremenetworks.com/extreme/topics/configuring-command-authorization-using-windows...

    From the above post...
    "These VSA's were used and supporting in older firmware (with limited commands) in FreeRadius server & Merit Radius servers.

    As this was supported with limited commands and only with few Radius servers, we have removed this from EXOS 15.1.3.1 onwards."

    -Ron


  • 3.  RE: Radius vs TACACS - CLI Authorization

    Posted 10-10-2015 10:26
    Yes, thank you for quoting what I already know about RADIUS.

    What about TACACS, does CLI authorization actually work?


  • 4.  RE: Radius vs TACACS - CLI Authorization

    Posted 10-10-2015 16:19
    Hi,

    yes, you can deny some commands with TACACS+ on EXOS.
    It was possible with Radius using the old VSA and some tweaking. Apparently, the VSA has been removed.


  • 5.  RE: Radius vs TACACS - CLI Authorization

    Posted 06-22-2016 09:08
    How to deny some commands with TACACS+ on EXOS ?
    How to assign admin right to account with TACACS+ ?


  • 6.  RE: Radius vs TACACS - CLI Authorization

    Posted 06-22-2016 09:08
    What TACACS+ server are you using?

    If it helps, one of the labs I built some time back used a variation of Cisco's TACACS+ server. The user config looked like this:
    # Configure User
    user = drew {
    login = cleartext "mypassword"
    service = exec {
    priv-lvl = 15
    }
    cmd = show {
    permit .*
    }
    cmd = download {
    permit .*
    }
    }
    user = admin {
    default service = permit
    login = cleartext ""
    }[/code]This gave "drew" an admin level account that could only run show and download commands, and denied everything else. You can also explicitly deny certain commands. The admin account was configured as it normally is on the switch by default.


  • 7.  RE: Radius vs TACACS - CLI Authorization

    Posted 06-22-2016 09:08
    Hi Drew

    It is work, thanks a lot.

    I have one more question
    If priv-lvl is not 15 and the user need to exec "show configuration"
    How to ?



  • 8.  RE: Radius vs TACACS - CLI Authorization

    Posted 06-22-2016 09:08
    Hi Kunlin,
    I don't recall how EXOS will handle that since that command requires an admin-level account. If you're able to do some testing, I'd be curious to see what you find out.


  • 9.  RE: Radius vs TACACS - CLI Authorization

    Posted 06-22-2016 20:19
    EXOS per-command authorization works OK if you're willing to use and modify FreeRADIUS.

    I did some investigations on a personal basis some time ago. This is very informally documented in this file:
    https://www.dropbox.com/s/m4ukvkrl3wyt2qq/EXOS%20Per-Command%20Authentication.docx?dl=0

    The document mentions several files that have to be installed in FreeRADIUS and that can be found here:
    https://www.dropbox.com/s/e944v2o73404f57/EXOS_PCA_files.zip?dl=0

    Be warned, this will work but with no guarantee. Also, Extreme Networks is not involved in any way in this development.

    Haven't played with it in a long time, so no guarantees it will work with the latest FreeRADIUS releases.

    Feel free to experiment.